CVE-2026-89726

lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

State: Published
Severity: Not scored
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

Patch series "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()", v2.

This series fixes an off-by-one out-of-bounds read in ucs2_strnlen().

The first patch is the real fix, the second patch comes as a bonus and fixes the code indentation.

This patch (of 2):

ucs2_strnlen() checks the current character before checking whether the caller-provided maximum length has been reached. If the input is not NUL-terminated within that bound, the loop can read one ucs2_char_t past the limit.

Test the length before dereferencing to prevent an off-by-one out-of-bounds read.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 04ae68af4107600120c3c41c94268f43bc350d48Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2e5a70a175f0c74e7238b013a96c4eabc3002934Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3ada20e110bf3245edb0a3bcddadc33d0f142f8dAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 60c74f42f5abddb85dd919b4448d5474e65dbe76Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 709eb41adaf78d59d4579a13a898125919b69bccAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7d658da725ea81c91f73087547b97e7ced82d62bAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1b0dc3cbb8630f0b5cb34d848628225920a904beAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cec0d03fe785380540dc1b4d07c80f67ae2ffc78Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 04ae68af4107600120c3c41c94268f43bc350d48Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2e5a70a175f0c74e7238b013a96c4eabc3002934Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3ada20e110bf3245edb0a3bcddadc33d0f142f8dAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 60c74f42f5abddb85dd919b4448d5474e65dbe76Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 709eb41adaf78d59d4579a13a898125919b69bccAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7d658da725ea81c91f73087547b97e7ced82d62bAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1b0dc3cbb8630f0b5cb34d848628225920a904beAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cec0d03fe785380540dc1b4d07c80f67ae2ffc78Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.